Wouldn't Facebook have to claim exclusive ownership of user data to have any standing in a legal action within the USA? That seems highly unlikely to me.

In the unlikely event that Facebook did push its luck, NYU has perfectly qualified lawyers of its own.

This isn't about poor helpless NYU. It is clearly a PR move to make loud public noise about Facebook misbehavior, mostly about questionable ad practices. The cease and desist action just provides the moment for Facebook critics.

I responded to a comment that was later edited to remove the statement with which I took issue. I agree with you.